Monitoring Splunk

When troubleshooting data ingestion on search heads, which SH is best to use ?

damode1
Path Finder

As the title says, when troubleshooting data ingestion on search heads e.g. running an SPL to check if certain data is landing to that index or searching through an addon like aws to check its diagnostic logs on the HF.

For tests like these, which search heads are best to use, monitoring console or a regular search head or an SHC ?

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @damode1,

when you speak of troubleshooting data ingestion, probably you're meaning of serching on Splunk.

In this case you can use every Search Head that can access data, there isn't any prefereable one.

If instead you are using SHs for inputs, it isn't correct, it's always better to have different roles (usually Universal or Heavy Forwarders) to ingest data.

The only exception is Splunk Cloud, where in the Search Heads you can do almost everything.

Ciao.,

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...